CWE-23: Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Also known as Zip Slip.
A kind of CWE-22 Path traversal.
From the CWE List. © The MITRE Corporation.
Newest
- tautulliTautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint8.6 High
- fortinet fortiwebA Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7...4.7 Medium
- vitejs viteVite's `server.fs` settings were not applied to HTML files2.3 Low
- ibm jazz foundationIBM Jazz Foundation path traversal6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform's configuration files can be accessed through jsx and sx endpoints9.3 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform's configuration files can be accessed through the webjars API9.3 Critical
- sun.net ehrd ctmsSunnet｜eHRD CTMS - Arbitrary File Reading through Path Traversal6.9 Medium
- apereo opencastOpencast has a partial path traversal vulnerability in UI config2.7 Low
- ai3 qbicrmgatewayAi3｜QbiCRMGateway - Arbitrary File Reading through Path Traversal8.7 High
- sma boy 3.0, boy 3.6, boy 4.0 +2 more +4 moreSMA: Directory Traversal in Sunny Boy <3.10.27.R6.5 Medium
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie5.3 Medium
- fortinet fortisoarA relative path traversal vulnerability [CWE-23] in FortiSOAR 7.6.0, 7.5.0 through 7.5.1, 7.4 all...6.4 Medium
- fortinet forticamera, fortimail, fortindr +3 more +5 moreMultiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiMail version 7.6.0...4.2 Medium
- microsoft windows server 2025, windows server 2025 (server core installation) +1 moreWindows Kerberos Elevation of Privilege Vulnerability7.2 High
- vedo suite project suiteA path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to...6.5 Medium
- samsung electronics data management server, samsung data management server firmware +1 moreAn 'Arbitrary File Deletion' in Samsung DMS(Data Management Server) allows attackers to delete...6.1 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows7.7 High
- cybercentrecanada assemblylineAssemblyline 4 Service Client: Arbitrary Write through path traversal in Client code4.2 Medium
- logpointAn issue was discovered in Logpoint before 7.6.0. An attacker with operator privileges can...8.4 High
- simogeo filemanagerFilemanager is vulnerable to Relative Path Traversal through filemanager.php6.5 Medium
- wellchoose batchsigncsWellChoose｜BatchSignCS - Arbitrary File Write through Path Traversal8.7 High
- microsoft remote desktop client, remote desktop client for windows desktop, windows 10 version 1507 +36 more +38 moreRemote Desktop Client Remote Code Execution Vulnerability8.8 High
- jhenggao ipublish systemJhenggao iPublish System - Arbitrary File Reading through Path Traversal8.7 High
- miko mikopbxPBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a...9.9 Critical
- raspap raspap-webguiraspap-webgui has a Directory Traversal vulnerability6.3 Medium
- innocommerce innoshopInnoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated...7.4 High
- sitecore experience commerce, experience manager, experience platform +1 more +3 moreSitecore XM, XC, and XP Post-Auth RCE via Zip Slip8.8 High
- ibm aix, vios +1 moreIBM AIX command execution8.4 High
- b. braun melsungen ag onlinesuiteRelative Path Traversal in OnlineSuite9.8 Critical
- rjarry aercaerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path...5.8 Medium
- astrbotAstrBot Has Path Traversal Vulnerability in /api/chat/get_file7.5 High
- atheosMissing Path Validation Enables Path Traversal in Controller.php9.4 Critical
- arraytics eventinWordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability7.5 High
- getkirby kirbyPath traversal of collection names during file system lookup6.3 Medium
- getkirby kirbyKirby vulnerable to path traversal in the router for PHP's built-in server2.3 Low
- getkirby kirbyKirby vulnerable to path traversal of snippet names in the `snippet()` helper6.3 Medium
- fortinet forticlientems, forticlientems cloud +1 moreA Relative Path Traversal vulnerability [CWE-23] in FortiClientEMS 7.4.0 through 7.4.1 and...5.0 Medium
- go standard library os, golang go +1 moreImproper access to parent directory of root in os3.8 Low
- bosch rexroth ag ctrlx os - device adminA vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS...7.1 High
- bosch rexroth ag ctrlx os - solutionsA vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows...5.4 Medium
- devexpressDevExpress before 23.1.3 allows arbitrary TypeConverter conversion.3.5 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was...4.9 Medium
- jetbrains riderIn JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite...5.4 Medium
- collaboraonline onlineCollabora Online Vulnerable to Arbitrary File Write8.3 High
- umbraco umbraco-cms, cms +1 moreUmbraco has a Management API Vulnerability to Path Traversal With Authenticated Users8.8 High
- ratta supernote a6 x2 nomadRatta SuperNote A6 X2 Nomad before December 2024 allows remote code execution because an...8.1 High
- cristián lávaque s2memberWordPress s2Member plugin <= 250419 - Local File Inclusion vulnerability4.9 Medium
- fortinet fortisiemA relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0...9.7 Critical
- smackcoders wp ultimate csv importer – import csv, xml & excel into wordpressImport Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
org.noear:solon-viewMavenopensolon org.noear.solon.core.handle.RenderManager aa render_mav path traversal5.3 Medium- Show moreLoading…